Quick log growing with "IP multicast routing failed"

David_M_Almas — Fri, 28 May 2021 18:36:00 GMT

Hi all!

We're using a cluster of 15400 appliances running R80.40 in VSX (VSLS mode).

Since a few days ago our older logs started being deleted because of log files increasing way faster than before.

We found that the culprit is a message from 2 new appliances recently installed in one of our VLANs. Those appliances are trying to reach a bunch of multicast addresses and the Check Point gateway fails to resolve the route:

@;1403431;[vs_2];[tid_6];[fw4_6];fw_log_drop_ex: Packet proto=17 10.80.202.51:2252 -> 224.2.2.1:2251 dropped by fw_log_ip_routing_failure Reason: IP multicast routing failed (too many packets received before route was resolved);

We tried configuring Multicast Restrictions under the interface configuration for those multicast addresses but no luck. Also sk170922 doesn't seem to apply. Tried adding a adbkern.conf file to $PPKDIR/conf/ with the line "adp_mc_rt_hold_queue_len=20" and rebooting the gateways: still no luck. Also disabled the "Enable drop optimization" in the corresponding VS with the same result. No luck also in configuring a simple rulebase to just silently drop all the requests from this appliances...

The vendor of the appliances are working on a solution but it will take some time (why?!?!?).

Is there any chance that we could disable the logging of this events/errors or somehow silently dropping them?

Any help is welcome! 🙂

Re: Quick log growing with "IP multicast routing failed"

PhoneBoy — Fri, 28 May 2021 23:18:03 GMT

Recommend a TAC case.

Re: Quick log growing with "IP multicast routing failed"

David_M_Almas — Tue, 01 Jun 2021 11:19:45 GMT

So we did and the workaround is to set "fw_log_missing_route_packet" to '0' to disable logging of this errors.

topic Re: Quick log growing with "IP multicast routing failed" in Firewall and Security Management

Quick log growing with "IP multicast routing failed"

Re: Quick log growing with "IP multicast routing failed"

Re: Quick log growing with "IP multicast routing failed"